We carry out a simple membership attack to show the improved privacy from our synthetic data set. We assume that we are given black-box access to 1) the ArcFace model trained on MS-Celeb-1M which was used in training our modified StyleGAN2 2) the ArcFace model trained on our synthetic data. Given an identity, the goal of a membership attack is to determine if the identity was used in the training of the model. Our membership attack seeks to exploit the difference in prediction entropy of a target model between its training set and a test set, as per [1]}.
